Εθνική Στρατηγική για την Τεχνητή Νοημοσύνη (ΤΝ) της Κυπριακής Δημοκρατίας

PUBLIC CONSULTATION
SUBMISSION
Cyprus National AI Strategy 2032
Legal, regulatory, policy and implementation amendments
Submitted by: THE HYBRID LAWTECH FIRM, empowered by Christiana Aristidou LLC
Consultation: National AI Strategy of the Republic of Cyprus to 2032
Consultation deadline: 31 August 2026
Submission date: 30 August 2026
Review cut-off: Law, policy, standards and published consultation material available by 30 August 2026
Scope: Legal architecture, regulatory coherence, standardisation, public policy, emerging-technology convergence, compliance, procurement, startups and delivery
Recognition of the Strategy’s strengths
THE HYBRID LAWTECH FIRM recognises the substantial work undertaken to develop a comprehensive national vision to 2032. The Strategy contains many very positive and forward-looking elements, particularly its commitments to trustworthy and human-centred AI, productivity, skills, research, public-service transformation, secure infrastructure, responsible governance and international cooperation. It gives Cyprus an important platform from which to build. This submission seeks to preserve those strengths and provide the legal, regulatory, standards and delivery architecture needed to make them implementable and internationally credible.
Bottom line
The Strategy’s ambition and strong elements should be retained. Before final adoption, however, it needs targeted but material refinement: a current policy baseline; concordance with the draft 2026 national AI implementing law and the enacted framework; clear institutional mandates; accurate treatment of law, standards and assurance; integrated rights, data, cybersecurity, procurement, liability and evidence controls; explicit treatment of technology convergence; and a costed, sequenced delivery plan. Flagship proposals must be reframed wherever a strategy cannot itself create regulatory approvals, EU-wide legal presumptions, judicial powers, certification status, legal equivalence or safe harbours. With these amendments, the Strategy can become a strong, executable foundation for trusted AI in Cyprus.
Contents
1. Executive position
2. Assessment framework
3. Detailed consultation comments
4. Cross-cutting implementation package
Annex A. Legal and regulatory map
Annex B. Standards architecture
Annex C. Authoritative sources

How to use this document
Section 1 may be pasted into the platform’s general-comment field. Each HLTF entry in Section 3 is self-contained and can be submitted against the identified Strategy section. Proposed wording is drafted for direct insertion or adaptation by the drafting authority.
 
1. Executive position
THE HYBRID LAWTECH FIRM welcomes the substantial work undertaken to develop the Strategy and supports its objective of positioning Cyprus as a trustworthy, innovative and internationally connected jurisdiction for artificial intelligence. The draft contains many valuable and forward-looking elements. It does not yet, however, provide a sufficiently coherent legal and delivery architecture for a national strategy extending to 2032. Its principal weakness is not a lack of ideas or ambition; it is the absence of sufficiently disciplined boundaries between law, policy, standards, certification, institutional power, evidence and implementation.
The final Strategy should be amended before adoption. In particular, it should no longer state without qualification that it builds on the National Digital Strategy 2020–2025. That strategy had expired before this consultation. The legally and strategically sound response is not to declare the AI Strategy automatically invalid, but to require a published transition evaluation and a live baseline connected to the National Digital Decade Strategic Roadmap and any formally adopted successor instruments.
The sequencing of national measures also matters. A draft law implementing Regulation (EU) 2024/1689 was placed in public consultation on 16 August 2026 while the Strategy consultation remained open. That Bill identifies competent, notifying, market-surveillance, accreditation and sandbox functions. The final Strategy must therefore be conformed to the enacted national framework. A policy document should not anticipate, duplicate or contradict statutory mandates.
The Strategy should also treat standardisation as implementation infrastructure, expressly recognise CYS and the national delegation/mirror-committee mechanism, and distinguish voluntary international standards from European harmonised standards cited in the Official Journal. This is essential to make governance, procurement, testing, evidence, interoperability, training and market access operational – not merely aspirational.

1.1 Text for the general-comment field
THE HYBRID LAWTECH FIRM, empowered by Christiana Aristidou LLC, recognises the substantial work undertaken to prepare the Cyprus National AI Strategy 2032, welcomes its many positive and forward-looking elements, and supports its ambition. This submission seeks to preserve those strengths while recommending the material amendments needed before final adoption. The Strategy should be converted from a broad catalogue of aspirations into a legally coherent, costed and accountable delivery framework. First, it should replace unqualified reliance on the expired National Digital Strategy 2020–2025 with a published transition evaluation and a current baseline linked to Cyprus’s National Digital Decade Strategic Roadmap and any formally adopted successor policies. Secondly, following publication of the draft national law implementing Regulation (EU) 2024/1689 during this consultation, the final Strategy should include a formal concordance with the enacted law and should distinguish policy coordination from statutory regulation, market surveillance, accreditation, certification, enforcement and regulatory-sandbox functions. Thirdly, it should accurately distinguish binding law, European harmonised standards, other European and international standards, professional credentials and government guidance; recognise CYS and Cyprus’s national delegates; correct the treatment of ISO/IEC 42001; and establish a standards roadmap covering CEN-CENELEC JTC 21, ISO/IEC JTC 1/SC 42, ETSI and relevant DLT, cybersecurity and sector committees. Fourthly, major initiatives should pass integrated legality, fundamental-rights, data-protection, equality, accessibility, security, procurement, competition, liability, evidence and sustainability gates. Claims concerning an ‘AI judge’, EU-wide ownership presumptions through AIREG, AML certificates that enable reliance, pre-certification and international equivalence should be deleted or reframed within applicable law. Finally, the Strategy should address the convergence of AI with blockchain/DLT, smart contracts, digital identity and trust services, IoT, digital twins, cloud-edge/HPC, robotics and cybersecurity through technology-neutral architectures and use-case tests. Delivery should be supported by named owners, budgets, baselines, model procurement clauses, SME pathways, public registers, independent evaluation and an annual legal/standards update. These changes would preserve ambition while materially increasing lawfulness, implementability, investor confidence, public trust and international interoperability.

1.2 Priority amendments
1. Legal concordance: Conform governance, powers, sandboxes and enforcement to the final 2026 implementing law.
2. Current policy baseline: Replace unqualified reliance on the expired 2020–2025 Digital Strategy with an evaluated transition and current roadmap.
3. Clear legal hierarchy: Separate binding law, harmonised standards, voluntary standards, guidance and aspirational programmes.
4. Institutional integrity: Publish a RACI and separate sponsor, operator, assurance, accreditation, certification and enforcement functions.
5. Rights-by-design: Apply integrated legality, FRIA/DPIA, equality, accessibility and remedy gates before public-sector use.
6. Procurement controls: Adopt mandatory AI tender and contract clauses before launching transformational procurements.
7. Data governance: Create lawful, federated and documented access rules rather than relying on the metaphor of State ownership.
8. Critical infrastructure: Map NIS2/CER/CRA duties, concentration risks, continuity, incident reporting and resource constraints.
9. Convergence: Address AI with DLT, identity, IoT, digital twins, cloud-edge/HPC, robotics, cybersecurity and smart contracts.
10. Correct flagship claims: Recast AI judge, AIREG, AML certificates, pre-certification and equivalence claims within lawful limits.
11. SME scale-up: Provide proportionate clinics, test support, templates, compute and procurement access tied to evidence.
12. Measurable delivery: Cost the portfolio, reconcile KPIs, assign owners and publish independent evaluation and change logs.

1.3 Overall institutional position
1. Regulation creates enforceable duties; standards provide common technical and organisational methods; accreditation attests competence of conformity-assessment bodies; certification evaluates against a defined scheme; policy selects public outcomes. The final Strategy should keep these functions separate and deliberately connected.
2. The Strategy should be technology-neutral but not technology-blind. AI is increasingly embedded in distributed systems. Cyprus can build a defensible niche by combining legal and regulatory capability with active European and international standards participation across AI, DLT and digital evidence.
3. Public trust will depend less on visionary labels than on visible control: lawful authority, transparent procurement, demonstrable evidence, human accountability, complaint routes, secure and portable infrastructure, and the capacity to stop systems that do not deliver safe public value.

2. Assessment framework
This submission reviewed the full Strategy, relevant Cyprus and EU legislation and policy instruments, applicable standardisation materials, the proposed 2026 national AI implementing law, and the public comments available on the consultation platform as at 30 August 2026. Public comments and other consultation materials were used only to identify recurring implementation concerns; the analysis, conclusions and proposed wording are presented independently by THE HYBRID LAWTECH FIRM.
2.1 Five tests applied
1. Legality: Is there an identified competence, legal basis, responsible authority, procedural safeguard and route of review?
2. Regulatory coherence: Does the proposal fit the AI Act as amended, the draft national law, the wider EU digital acquis and sector regulation?
3. Assurance: Can the claimed outcome be evidenced through standards, testing, audit, conformity assessment, records and independent oversight without confusing their legal effects?
4. Deliverability: Are the owner, budget, procurement route, dependencies, skills, infrastructure, contract rights, timeline and stop/scale criteria specified?
5. Future fitness: Does the proposal remain technology-neutral, interoperable, portable, rights-preserving and adaptable to convergence and regulatory change?
2.2 Four-layer drafting rule
The Strategy should apply a four-layer drafting rule that clearly distinguishes law, standards, assurance, and policy and delivery.
Law: EU and Cyprus legislators, together with competent authorities, create duties, powers, procedures, sanctions and legal effects. The Strategy must not imply that a policy statement itself creates a legal power or exemption.
Standards: CEN, CENELEC and ETSI, together with ISO/IEC and the national standards system, provide consensual specifications and, in defined cases, support conformity. The Strategy must not imply that all standards are mandatory or that compliance with a standard automatically confers a presumption of conformity.
Assurance: Accreditation bodies, conformity-assessment bodies, auditors and testing facilities assess competence, evidence or conformity within a defined scope. The Strategy must not imply that participation in a sandbox, laboratory, badge or audit is equivalent to regulatory approval.
Policy and delivery: Government and accountable public bodies set outcomes, fund, procure, coordinate, publish guidance and evaluate. The Strategy must not imply that a proposed programme overrides law, regulators, courts or independent bodies.

2.3 Principal implementability risks
1. Institutional risk: overlapping authority names and functions may produce unlawful delegation, duplicated supervision or conflicted assurance.
2. Reliance risk: users may treat policy labels, registries, credentials or laboratory outputs as legal certification or safe harbour.
3. Procurement risk: ambitious early tenders may entrench proprietary models, weak audit rights and expensive exit before the governance framework exists.
4. Rights risk: high-impact public AI may be piloted without a complete legality, necessity, discrimination, accessibility and remedy analysis.
5. Investment risk: unsupported KPIs and selective international comparisons may weaken credibility with investors, EU institutions and funding evaluators.
6. Infrastructure risk: cloud/model concentration and energy-water constraints may undermine claimed sovereignty and resilience.
7. Evidence risk: insufficient provenance and forensic readiness may make incidents, liability and regulatory investigations difficult to reconstruct.
 
3. Detailed consultation comments
Each entry below is drafted to stand alone in the public-consultation platform. References are to the numbered sections and descriptive passages of the consultation version of the Strategy. Proposed text may be inserted directly or adapted while preserving the legal distinction and implementation control identified in the comment.
HLTF-01. State the legal status of the Strategy and establish a legal-dependency rule
Strategy reference: Cross-cutting; §§1.1, 2.3.3, 3.3, 3.9.6, 4.3 and Annex A
Comment type: Legal / governance / drafting
Comment and implementation risk. The text alternates between policy language, mandatory language and claims that new authorities, registries, audits, certificates and legal presumptions will exist. A strategy may direct policy and spending, but cannot itself create statutory powers, binding duties, judicial procedures, presumptions of ownership, certification status or regulatory equivalence. Leaving the hierarchy unstated exposes ministries, procurers, businesses and citizens to reliance on propositions that may have no legal basis.
Requested amendment. Insert an interpretation clause that separates law, standards, government policy and proposed initiatives, and make every legally dependent initiative conditional on competence, enactment, funding and impact assessment.
Proposed text for insertion or replacement
Legal status and dependencies. This Strategy is a policy framework. It does not of itself create statutory powers, legal duties, regulatory approvals, evidential presumptions, certification status or rights of reliance. References to ‘shall’ bind public bodies only to the extent authorised by applicable law and a duly approved implementation instrument. Each initiative shall be entered in a public legal-dependency register identifying the legal basis, competent authority, required primary or secondary legislation, applicable EU law, standards profile, budget, accountable owner and commencement condition. No initiative affecting rights, market access, supervision, certification or judicial decision-making shall become operational until those conditions are satisfied.

HLTF-02. Replace the expired digital-strategy foundation with a current, evidenced baseline
Strategy reference: §2.3.2 and footnote 10; §2.2; Annex A
Comment type: Strategic / evidence / drafting
Comment and implementation risk. Section 2.3.2 says the Strategy is aligned with the ‘existing Digital Strategy’, while footnote 10 identifies the National Digital Strategy 2020–2025. That instrument had expired before this 2026–2032 Strategy was consulted. Expiry does not automatically invalidate the AI Strategy, but it makes the asserted foundation incomplete and potentially misleading unless there is an evaluation of delivery, unresolved dependencies and a formal transition to current policy. The document also uses the undefined expression ‘revised Digital Strategy’ elsewhere.
Requested amendment. Delete the unqualified reliance on the expired instrument. Add a transition and baseline annex linked to the National Digital Decade Strategic Roadmap and any successor digital strategy, with version control and an update trigger.
Proposed text for insertion or replacement
Digital-policy baseline. The Strategy takes account of lessons and assets arising from the National Digital Strategy 2020–2025, but does not treat that expired instrument as the current policy foundation. Within 90 days of adoption, the Deputy Ministry shall publish a transition statement that: (a) evaluates the 2020–2025 Strategy against its objectives; (b) identifies completed, continuing, superseded and unimplemented measures; (c) maps dependencies to the current National Digital Decade Strategic Roadmap and any formally adopted successor digital strategy, data strategy, cloud policy and interoperability framework; and (d) reconciles baselines, budgets, owners and dates. References in this Strategy shall identify the title, version, approval date and status of the policy instrument relied upon.
HLTF-03. Make the methodology, country benchmarking and evidence base reproducible
Strategy reference: §§1.6–1.7; sector ‘International alignment’ passages; Annex H
Comment type: Policy / evidence / international relations
Comment and implementation risk. The Strategy names a small set of countries as ‘pioneers’ and states that selected national strategies informed the work, but gives no selection criteria, comparator groups, variables, time periods, performance evidence or transferability test. Comparative learning is valuable; selective endorsement without a method may imply an official ranking, overlook relevant Member States and create unnecessary reputational or competitive signalling. The listed meetings likewise do not amount to a published stakeholder map, evidence register or impact assessment.
Requested amendment. Replace country praise with a neutral benchmarking method and publish the evidence, assumptions, limitations and consultation-response report.
Proposed text for insertion or replacement
Comparative and consultation methodology. International examples shall be used as evidence sources, not as country rankings or general endorsements. A benchmarking annex shall identify the policy question, transparent selection criteria, peer group, indicators, data year, source quality, implementation outcomes, Cyprus transferability constraints and limitations for each comparator. The final Strategy shall include an evidence register, stakeholder-category map, summary of options considered, principal assumptions, distributional and fundamental-rights impacts, and a reasoned consultation report explaining which material comments were accepted, partly accepted or rejected. Country references unsupported by that method shall be removed or expressed neutrally.
HLTF-04. Conform the Strategy to the 2026 draft AI implementing law and the final enacted framework
Strategy reference: §3.3.1; §3.9.6; §§3.13–4.3; Annexes A–C
Comment type: Legal / institutional sequencing
Comment and implementation risk. The proposed national law for implementing Regulation (EU) 2024/1689 was published for consultation on 16 August 2026, during the Strategy consultation. It allocates functions to the Commissioner of Electronic Communications, the Commissioner for Personal Data Protection, the Central Bank and any further designated authority; identifies the national accreditation function; and provides a national regulatory-sandbox mechanism. The Strategy instead creates or names bodies with overlapping regulatory, audit, registry, certification and sandbox functions. The two instruments cannot safely proceed on parallel, inconsistent institutional assumptions.
Requested amendment. Require a formal concordance after the Bill is finalised, preserve the authority of the legislature and regulators, and distinguish policy coordination from statutory supervision.
Proposed text for insertion or replacement
Institutional concordance. Before the Strategy is submitted for final approval, and again following enactment of the national law implementing Regulation (EU) 2024/1689, the Attorney-General’s Office and the responsible Deputy Ministry shall complete and publish an article-by-article concordance table. It shall map every Strategy body and function to the competent authority, legal basis, accountability route, appeal or complaint mechanism, information-sharing power and funding source. Strategy bodies may coordinate policy and delivery but shall not exercise market-surveillance, notifying-authority, accreditation, certification, enforcement, complaints, sanctioning or regulatory-sandbox powers unless those powers are expressly conferred by applicable law. Any inconsistent Strategy wording shall be amended automatically through a published conformance update.
HLTF-05. Clarify governance, names, accountability and separation of functions
Strategy reference: §§3.3.1–3.3.2; glossary; Annex B
Comment type: Governance / administrative law
Comment and implementation risk. The governance architecture uses inconsistent names and roles, including ‘Council’ and ‘Committee’, and describes the Taskforce both as independent advisory body and central coordinating body. The National AI Authority is simultaneously presented as policy coordinator, executor and control gatekeeper. Other entities prototype, validate, procure, approve, monitor or certify. Without a single responsibility matrix, the same institution may sponsor a system and assure it, weakening independence and creating conflicts.
Requested amendment. Publish a definitive governance schedule and apply separation of policy, delivery, assurance and enforcement.
Proposed text for insertion or replacement
Governance and separation of functions. Annex A shall contain the definitive name, legal form, mandate, membership, appointment process, term, conflicts policy, decision rights, reporting line, budget and review date for every Strategy body. A RACI matrix shall cover policy, funding, procurement, data access, development, deployment approval, conformity assessment, audit, incident response, market surveillance and redress. No body that develops, funds, procures or operates an AI system shall provide the final independent assurance or statutory enforcement decision for that same system. Duplicate names and inconsistent glossary definitions shall be corrected. Existing constitutional, ministerial, regulatory, judicial and independent-authority competences remain unaffected.
HLTF-06. Recognise CYS and preserve the national quality-infrastructure boundaries
Strategy reference: §§1.4.3–1.4.10, 2.5.1, 3.3.1, 3.12; §4.3; Annexes A, C and H
Comment type: Legal / standards / institutional
Comment and implementation risk. Formal standardisation is treated intermittently, CYS is not assigned a role, and ‘standards’ are sometimes described as outputs of the proposed National AI Authority. CYS is Cyprus’s official National Standardisation Body and exercises the national standardisation activity pursuant to Law 156(I)/2002, including national coordination and representation in CEN, CENELEC, ISO and IEC. Standardisation, accreditation, conformity assessment/certification, regulation and policy guidance are related but legally distinct functions.
Requested amendment. Insert CYS into the governance and implementation architecture as standards coordinator, while expressly preserving the roles of regulators, the national accreditation body and conformity-assessment bodies.

Proposed text for insertion or replacement
National standardisation and quality infrastructure. CYS, as Cyprus’s official National Standardisation Body exercising the national standardisation activity pursuant to Law 156(I)/2002, shall coordinate national standards intelligence, national mirror-committee participation, adoption of European standards and access to international standards work relevant to this Strategy. The National AI Authority may issue policy frameworks, implementation guidance and common administrative controls, but shall not present those instruments as national, European, harmonised or international standards. Accreditation shall remain with the legally designated national accreditation body; certification and conformity assessment shall be performed only by competent bodies under applicable schemes; and statutory supervision shall remain with the competent authorities. A written cooperation protocol shall prevent overlap.

HLTF-07. Correct the legal effect and technical description of standards
Strategy reference: §§2.3.4, 3.11.2, 3.12.4, 3.13.1–3.13.3; Annex A; Annex H
Comment type: Technical / legal accuracy
Comment and implementation risk. The Strategy recommends ‘ISO 42001 as a standard for risk management’, treats ISO/IEC 27001 as if it were sufficient for AI security, and places the AIGP professional credential alongside standards. ISO/IEC 42001 is an AI management-system standard; ISO/IEC 23894 is dedicated AI risk-management guidance. A voluntary standard does not itself prove compliance with the AI Act. Under Article 40 of the AI Act, only an applicable harmonised standard or part cited in the Official Journal may confer the specified presumption of conformity.
Requested amendment. Replace the current wording with a standards taxonomy and risk-based profile; correct Annex H.
Proposed text for insertion or replacement
Use and legal effect of standards. ISO/IEC 42001:2023 may support an organisational AI management system; ISO/IEC 23894:2023 may support AI risk management; ISO/IEC 42005:2025 may support AI system impact assessment; ISO/IEC 5338:2023 may support lifecycle processes; the ISO/IEC 5259 series may support data-quality governance; and ISO/IEC 27001:2022 and related controls may support information security. These references are voluntary unless law or contract makes them applicable. They do not replace legal analysis or automatically demonstrate AI Act conformity. Applicable European harmonised standards developed through CEN-CENELEC JTC 21 shall be monitored and used where appropriate after adoption and, for presumption of conformity, OJEU citation. Professional credentials shall be listed as training credentials, not standards.
HLTF-08. Use the current AI Act and remove blanket registration and obsolete timing claims
Strategy reference: §3.9.6; §§3.11–3.13; Annex A; sector roadmaps
Comment type: EU law / compliance
Comment and implementation risk. The Strategy includes readiness language tied to 2 August 2026, although consultation continues after that date, and says every organisation must register AI systems in the EU database ‘without exception’. Registration under the AI Act is role- and category-specific; it is not a universal registry duty. The legal timetable was also amended by Regulation (EU) 2026/1744, which entered into force on 27 July 2026. Static or inaccurate dates will make a 2032 strategy obsolete immediately.
Requested amendment. Replace blanket claims with a maintained obligations register based on the AI Act as amended.
Proposed text for insertion or replacement
AI Act implementation register. All references to Regulation (EU) 2024/1689 shall mean that Regulation as amended, including Regulation (EU) 2026/1744, and any applicable delegated or implementing acts. The National AI Authority shall maintain, with the competent authorities, a dated public implementation register identifying obligations by role, system category and commencement date. Registration in the EU database or any national register shall be required only where applicable law requires it. The national implementation plan shall distinguish prohibited practices, transparency obligations, general-purpose AI obligations, Annex III high-risk systems, safety components of regulated products, public-authority deployer duties, fundamental-rights authorities and sector-specific law.
HLTF-09. Redesign NAICF, audits and the proposed certification lab around lawful conformity routes
Strategy reference: §3.9.6; Legal Services pillar; §4.3
Comment type: Conformity assessment / legal / market access
Comment and implementation risk. The text proposes annual audits by a ‘Cyprus AI Security & Certification Authority’, a central registry of systems ‘certified under EU rules’, pre-certification of high-risk and ‘foundation’ models, and international equivalence bridges. It does not identify the legal basis, applicable standard, scheme, accreditation, notified-body route, scope of certificate, surveillance, complaints, liability or recognition mechanism. The AI Act uses the term general-purpose AI model and prescribes conformity routes; policy branding cannot create EU recognition or equivalence.
Requested amendment. Convert NAICF into optional readiness support unless and until a lawful scheme is established, and remove ‘pre-certification’, ‘dual recognition’ and blanket annual-audit claims.
Proposed text for insertion or replacement
National AI Compliance Framework. NAICF shall operate as a non-binding readiness, evidence and implementation-support framework unless a specific function is conferred by law. It shall not issue or imply regulatory approval, CE marking, presumption of conformity, notified-body status, accreditation, legal equivalence or safe harbour. Any audit or certification scheme shall identify its owner, normative requirements, competence criteria, accreditation basis, assessment route, scope, validity, surveillance, complaints, impartiality, liability and relationship to Articles 40–49 of the AI Act. The proposed laboratory may provide testing, evaluation and sandbox support; the terms ‘pre-certification’, ‘certified under EU rules’, ‘dual recognition’ and ‘foundation model’ shall be replaced by legally accurate descriptions.
HLTF-10. Create an integrated fundamental-rights and public-law assurance gate
Strategy reference: §§1.4.8, 2.5.5, 3.3.2, 3.9, 3.13; Annex B
Comment type: Fundamental rights / administrative law
Comment and implementation risk. The Strategy refers generally to ethics, fairness and mandatory legal assessments for high-impact systems but does not specify decision criteria, responsible officials, publication rules or interaction with the AI Act fundamental-rights impact assessment, GDPR data-protection impact assessment, equality, accessibility, children’s rights and administrative-law duties. ‘Ethics’ cannot replace legality, and a checklist cannot legitimise a use that lacks statutory competence or necessity.
Requested amendment. Add one integrated, risk-based assessment and approval gate before procurement and deployment of high-impact public-sector AI.
Proposed text for insertion or replacement
Integrated rights and legality assessment. Before procurement, pilot or deployment of high-impact public-sector AI, the accountable public body shall document: legal competence and purpose; necessity and proportionality; AI Act classification and any required fundamental-rights impact assessment; GDPR lawful basis, Article 22 analysis and any required DPIA; equality and non-discrimination; accessibility; child and vulnerable-person safeguards; human decision authority; notice, reasons, review, complaint and remedy; security; evidential integrity; and less intrusive alternatives. The assessment shall be reviewed by the competent legal, data-protection, security and domain functions. A non-confidential summary and decision shall be published, subject only to lawful restrictions. Ethics review supplements and does not replace legal compliance.
HLTF-11. Establish a lawful public-sector AI register, notice, human review and redress
Strategy reference: §§3.3.2, 3.4, 3.9.6; Annexes B–C
Comment type: Transparency / public law / rights
Comment and implementation risk. The proposed ‘AI Registry’ is framed as cataloguing all market solutions, but no purpose, legal basis, scope, confidentiality rule or relationship with EU registration is defined. Citizens need transparency about State use, while businesses require protection of trade secrets and security information. Article 86 of the AI Act provides a limited right to explanation in specified circumstances; it should not be expanded or reduced by imprecise strategy language.
Requested amendment. Create a public-sector register first, avoid duplicate filings, and define individual safeguards in legally accurate terms.

Proposed text for insertion or replacement
Public-sector AI transparency and redress. Cyprus shall maintain a public register of AI systems used by public bodies, linked where practicable to required EU registrations and avoiding duplicate filings. Each entry shall identify the accountable body, purpose, provider and material subcontractors, legal basis, AI Act classification, affected groups, data categories, human-oversight model, impact-assessment status, performance indicators, material incidents, procurement reference and complaint channel. Security-sensitive and protected commercial information may be withheld only on a documented legal basis. Affected persons shall receive meaningful notice and access to human review, reasons or explanation, complaint and judicial or administrative remedy to the extent provided by applicable law, without limiting stronger rights under other law. Non-digital service channels shall remain available for essential services.

HLTF-12. Recast data as a governed resource rather than an unqualified national asset
Strategy reference: §3.2; §3.7; sector data proposals; Annex A
Comment type: Data law / governance / interoperability
Comment and implementation risk. Calling data a ‘strategic national asset’ may be a useful policy metaphor but does not determine ownership, lawful access or reuse. The proposed lake, warehouse and hub model lacks a legal classification of personal, non-personal, confidential, open, sectoral and protected data; a controller/processor map; purpose and access rules; retention; provenance; data-quality metrics; rights management; and a decision between centralised and federated architecture.
Requested amendment. Insert a national AI data-governance framework aligned with the GDPR and the EU data acquis, and require data-product documentation.
Proposed text for insertion or replacement
Data governance for AI. Data shall be treated as a governed public-interest resource where law permits, not as property of the State by default. Before access or reuse, each dataset shall have a named steward; legal and rights classification; controller/processor or other role allocation; purpose and lawful basis; provenance; quality and representativeness measures; access conditions; licensing and intellectual-property status; retention and deletion rule; security classification; data-subject or third-party rights process; and audit record. Architecture shall favour federated access, minimisation and purpose limitation where centralisation is unnecessary. The framework shall align, as applicable, with the GDPR, Data Governance Act, Data Act, Open Data Directive, EHDS, trade-secret and copyright law, sector confidentiality and the European Interoperability Framework, supported by the ISO/IEC 5259 series and relevant European standards.
HLTF-13. Make public procurement the principal implementation control
Strategy reference: §§3.3.2, 3.4.1, 4.1; first six transformational procurements; Annex B
Comment type: Public procurement / contracts / implementation
Comment and implementation risk. The Strategy proposes six transformational procurements within eight months and an ‘AI-first’ procurement direction, but does not supply minimum readiness gates or contract terms. Buying quickly before requirements, data rights, interfaces, evidence and exit are defined can lock the State into providers and shift compliance risk to taxpayers. ‘AI-first’ may also bias problem definition toward technology instead of public value and proportionality.
Requested amendment. Replace ‘AI-first’ with problem-led, outcome-based and rights-preserving procurement, and publish mandatory clauses before major tenders.
Proposed text for insertion or replacement
AI procurement standard. Public bodies shall procure AI only where a documented problem, lawful purpose and proportionate business case show that AI is suitable compared with non-AI alternatives. Before tender, the body shall complete classification, data-readiness, rights, security, accessibility, competition and exit assessments. Mandatory contract schedules shall address: provider/deployer roles; model and material-subcontractor transparency; data, input and output rights; training and improvement use; logging and evidence retention; performance and bias testing; human oversight; cybersecurity; incident and regulator cooperation; material model-change control; audit access; service levels; intellectual property; confidentiality; product and professional liability; insurance; portability, open formats, interfaces and exit assistance; deletion/return of data; sustainability metrics; and termination. No transformational procurement shall launch until these templates and an independent assurance route are approved.
HLTF-14. Unify regulatory sandboxes, testbeds and innovation facilities
Strategy reference: §§3.4–3.9; LegalTech and sector sandboxes; §4.3
Comment type: Regulatory governance / innovation
Comment and implementation risk. The Strategy repeatedly proposes sector sandboxes and testing facilities without distinguishing a statutory AI regulatory sandbox from experimentation, testbeds, accelerators, centres of excellence and conformity assessment. The draft implementing Bill assigns the national regulatory sandbox to the identified competent authorities. Multiplying ‘sandboxes’ without a common legal gateway risks regulatory arbitrage, duplicated applications and false impressions of approval.
Requested amendment. Create one national sandbox framework with sector pathways and common entry, exit and publication rules.
Proposed text for insertion or replacement
Sandbox and testing architecture. The national AI regulatory sandbox shall be operated only by the authority or authorities designated by law and in accordance with the AI Act. Sector regulators, the Data Protection Commissioner, CYS, accreditation and conformity-assessment actors, research facilities and domain experts shall participate within their respective competences. Innovation hubs, accelerators and testbeds may provide technical experimentation but shall not imply regulatory approval. A single public framework shall define eligibility, SME and startup support, application criteria, real-world testing conditions, data protection, intellectual property, confidentiality, liability, incident response, standards participation, regulator coordination, duration, exit report, evidential value and the express statement that participation does not remove legal obligations.
HLTF-15. Treat the National AI Infrastructure as a regulated critical dependency
Strategy reference: §§3.7.1–3.7.4 and 3.13.2–3.13.3; Annex A
Comment type: Cybersecurity / resilience / critical infrastructure
Comment and implementation risk. The Strategy describes the National AI Infrastructure as critical national infrastructure but does not map designation, competent authorities or duties under NIS2, the CER Directive, the Cybersecurity Act, the Cyber Resilience Act or sector rules. Generic ‘national cybersecurity frameworks’ are insufficient for shared compute, model access, sensitive data, cross-border cloud, supply-chain threats and systemic concentration.
Requested amendment. Require a criticality and regulatory assessment before architecture or procurement, plus measurable resilience and recovery controls.
Proposed text for insertion or replacement
Critical AI infrastructure assurance. Before design approval, the responsible authority shall determine and publish the legal classification, essential/important-entity status, critical-entity dependencies and competent supervisory arrangements for each infrastructure component under NIS2, the CER Directive, applicable Cyprus law, the EU Cybersecurity Act, the Cyber Resilience Act and sector regimes. Architecture and procurement shall include zero-trust access, tenant isolation, secure development, model and data supply-chain controls, vulnerability handling, cryptographic agility, adversarial testing, logging, forensic readiness, continuity, geographic and provider concentration limits, tested recovery objectives, portability and exit, incident-reporting interfaces and independent security evaluation. ENISA guidance and applicable standards shall be tracked in a maintained control profile.
HLTF-16. Define digital sovereignty through measurable control, competition and exit
Strategy reference: §3.7.3; public-sector platforms; Annex C
Comment type: Competition / cloud / strategic autonomy
Comment and implementation risk. ‘Digital sovereignty’ is defined at a high level and then associated with specific infrastructure choices. Sovereignty is not achieved merely through local hosting, ownership or a favoured hardware architecture. A system may be physically local yet operationally dependent on a foreign hyperscaler, proprietary model, unavailable weights, non-portable data or a single integrator. Conversely, carefully governed European or cross-border services may increase resilience.
Requested amendment. Adopt outcome-based sovereignty criteria and technology-neutral procurement.
Proposed text for insertion or replacement
Digital sovereignty and contestability. Sovereignty shall be measured by lawful control over data and keys; ability to audit and govern models; continuity under supplier failure or geopolitical disruption; portability of data, prompts, logs, configurations and workloads; open and documented interfaces; substitutability of critical components; availability of skills and maintenance; compliance with EU law; and tested exit within defined time and cost. Procurement shall be technology-neutral and shall not prescribe a processor, model or distributed architecture without a published proportionality, security, competition and lifecycle-cost assessment. Multi-cloud or sovereign-cloud claims shall be evidenced, and material provider/model concentration shall be reported annually.
HLTF-17. Add a technology-convergence and distributed-systems strategy
Strategy reference: §§1.3–1.4, 2.3.4, 3.7, 3.12; sector roadmaps
Comment type: Emerging technology / standards / strategic
Comment and implementation risk. The Strategy largely treats AI as a standalone technology even though implementation will depend on cloud-edge/HPC, IoT, robotics, digital twins, digital identity and trust services, cybersecurity, smart contracts, tokenisation and blockchain/DLT. The absence is especially striking where the text already proposes a blockchain registry. Convergence affects architecture, evidence, security, liability, interoperability and skills; it should not be addressed through isolated use cases.
Requested amendment. Insert a horizontal, technology-neutral convergence section with a use-case test and coordinated standards participation.
Proposed text for insertion or replacement
Converging technology systems. Cyprus shall govern AI as part of distributed socio-technical systems that may combine cloud and edge computing, high-performance computing, IoT, digital twins, robotics and autonomous systems, digital identity and trust services, cybersecurity, smart contracts, tokenisation and blockchain/DLT. Each proposed combination shall pass a documented use-case test covering necessity, comparative architecture, legal roles, data flows, security, interoperability, environmental cost, governance, evidence and exit. DLT shall be used only where distributed control, tamper-evidence or shared state provides demonstrable value over a conventional database. CYS shall coordinate relevant participation across ISO/IEC JTC 1/SC 42, ISO/TC 307, CEN-CENELEC JTC 21, CEN/CLC JTC 19, ETSI and sector committees so that common system descriptions and interfaces can be developed without displacing committee competence.
HLTF-18. Correct AIREG: DLT records can support evidence, not manufacture ownership
Strategy reference: Legal Services pillar, pp. 74–76; AIREG
Comment type: Intellectual property / evidence / DLT
Comment and implementation risk. AIREG is said to provide ‘immutable certification’ and a strong presumption of ownership across the EU. A ledger entry can help prove that a particular hash or assertion existed at a time and has not been altered. It does not establish authorship, originality, title, lawful training, absence of infringement or the truth of the recorded claim, and a Cyprus strategy cannot create an EU-wide ownership presumption. Immutability also conflicts with rectification, revocation, key compromise and data-protection requirements if designed poorly.
Requested amendment. Recast AIREG as a feasibility study for a rights-evidence and provenance service aligned with eIDAS and IP law.
Proposed text for insertion or replacement
AI provenance and rights-evidence feasibility study. The proposed AIREG shall not be described as certifying ownership or creating a legal presumption across the Union. A feasibility study shall compare conventional and DLT architectures and assess legal basis, governance, evidential effect, identity assurance, time-stamping, qualified electronic ledgers and archiving under eIDAS as amended, WIPO and EU intellectual-property rules, GDPR, trade secrets, cybersecurity, interoperability, correction and revocation, key loss, dispute resolution, liability and long-term preservation. Any pilot may record signed claims, hashes, provenance events and licences, but shall state that technical integrity does not prove the truth, lawfulness, authorship or ownership of the underlying asset. Legal effect shall arise only from applicable law and admissible evidence.
HLTF-19. Remove the ‘AI Judge’ commitment pending constitutional and justice-system reform
Strategy reference: Legal Services pillar, pp. 74–76; Annex C
Comment type: Constitutional / judicial / fundamental rights
Comment and implementation risk. The proposal for an ‘AI judge’ in low-value, factually uncontested cases is not a mere digital-service project. It concerns the exercise of judicial power, independence and impartiality, Article 30 of the Constitution, Article 47 of the EU Charter, Article 6 ECHR, procedural law, open justice, evidence, reasons, appeal and equality of arms. Monetary value and absence of a factual dispute do not remove questions of law or vulnerability. AI used to prepare judicial decisions is also a high-risk category under the AI Act.
Requested amendment. Delete the commitment to an AI judge. Permit carefully governed administrative and judicial support only, unless future primary law and constitutional analysis authorise more.
Proposed text for insertion or replacement
Justice-sector AI. The term and proposal ‘AI Judge Capability’ shall be deleted. AI may be evaluated for transcription, translation, scheduling, search, document triage, legal research and non-binding decision support, subject to judicial governance, procurement, security, evidence, data protection, professional secrecy, accessibility and fundamental-rights safeguards. A natural judge or legally authorised decision-maker shall retain responsibility for the decision, factual and legal assessment, reasons and remedy. Any future proposal for automated adjudication shall require a separate public justice strategy, constitutional and human-rights opinion, primary legal basis, judicial and Bar consultation, equality and accessibility assessment, pilot evaluation, public transparency and an effective right to human determination and appeal.
HLTF-20. Govern court transcription and a Cyprus case-law model as justice infrastructure
Strategy reference: Legal Services pillar, pp. 74–76
Comment type: Justice / data / evidence / procurement
Comment and implementation risk. AI transcription and a case-law language model can improve access, but the current text does not address authoritative records, correction, speaker identification, protected hearings, anonymisation, hallucinations, source citation, copyright/database rights, judicial independence, professional secrecy or whether citizens may rely on outputs. A model trained on incomplete or non-authoritative judgments may entrench error.
Requested amendment. Add a justice-data governance and staged evaluation programme; never label model output as authoritative legal advice or an official judgment.
Proposed text for insertion or replacement
Court records and case-law AI. The Supreme Court and competent justice authorities shall own governance of any transcription or case-law AI service. A pilot shall define the authoritative record, human verification, correction procedure, source provenance, citation to the controlling judgment, coverage limitations, protected-hearing controls, anonymisation, retention, access tiers, cybersecurity, professional secrecy, copyright and database rights, model evaluation and incident response. Public outputs shall disclose that they are generated or assisted by AI and are not the authoritative judgment or legal advice. No system shall train on confidential material or use court data for provider model improvement without express legal and contractual authority. Independent accuracy, language and equality testing shall precede scale-up.
HLTF-21. Limit the Digital AML Certification Scheme to interoperable evidence exchange
Strategy reference: Legal Services pillar, pp. 74–76; Financial Services pillar
Comment type: AML / financial regulation / liability
Comment and implementation risk. The proposed certificate would ‘enable reliance’ by obliged entities and authorities. Under EU and national AML rules, reliance, outsourcing and information exchange do not automatically transfer each obliged entity’s responsibility for customer due diligence, risk assessment, monitoring, sanctions controls and suspicious-activity reporting. A certificate may become stale, be wrong, reveal sensitive data or create systemic reliance on one provider.
Requested amendment. Reframe the initiative as a regulated, revocable and purpose-limited evidence exchange; do not promise discharge from AML duties.
Proposed text for insertion or replacement
Digital AML evidence exchange. Any Digital AML Certification Scheme shall be developed with the competent AML supervisors, Data Protection Commissioner and obliged-sector representatives, and aligned with the applicable EU AML package, GDPR, eIDAS, DORA and sector secrecy. It may support interoperable, verifiable and time-bounded exchange of specified due-diligence evidence, but shall not state or imply that an obliged entity is discharged from its own legal duties. The scheme shall define issuer competence, assurance level, data minimisation, consent or other legal basis, permitted reliance, freshness, revocation, sanctions and PEP updates, correction, audit, liability allocation, regulator access, cross-border transfer, cyber incident handling and alternatives for persons unable to use the service.
HLTF-22. Add a complete intellectual-property, trade-secret and AI value-chain framework
Strategy reference: §§3.2, 3.5, 3.11; Legal Services pillar; Annex A
Comment type: IP / commercial law / GPAI
Comment and implementation risk. The Strategy proposes clarifying protection for ‘computer-generated works’ but does not address the full value chain: training-data acquisition and text-and-data-mining reservations; rights in datasets, models, prompts and outputs; open-source licences; employee/contractor ownership; confidential information; model-provider terms; GPAI copyright duties; provenance; infringement allocation and remedies. Creating a bespoke national right without EU-compatibility analysis could fragment the internal market or produce false confidence.
Requested amendment. Replace the narrow promise with an expert review and standard contractual toolkit aligned with EU law.
Proposed text for insertion or replacement
AI intellectual-property and value-chain framework. Cyprus shall undertake an evidence-based review of copyright, database rights, trade secrets, patents, open-source licensing, contractual rights and GPAI obligations across data acquisition, training, fine-tuning, retrieval, deployment and output use. The review shall assess EU competence and harmonisation limits before proposing national legislation. Public procurement and SME support shall include model clauses on authorised data use, text-and-data-mining reservations, provenance, confidential inputs, provider training use, model and output licences, open-source obligations, infringement warranties, notice-and-takedown, indemnities, audit evidence and termination. No registry entry or contractual label shall be presented as creating ownership that applicable law does not recognise.
HLTF-23. Build a proportionate startup and SME compliance-to-scale pathway
Strategy reference: §§2.5.4, 3.5, 4.2–4.3; NAICF Comply and AdoptNAICF
Comment type: Startups / SMEs / investment / State aid
Comment and implementation risk. The Strategy rightly prioritises adoption and funding, but certification-heavy or one-size-fits-all requirements may price startups out before product-market fit. Conversely, grants without legal, procurement and evidence readiness can fund pilots that never scale. National-residency preferences may also conflict with EU procurement, establishment and State-aid rules. Support must follow role, risk and maturity.
Requested amendment. Create staged support from classification to cross-border scale, using lawful access criteria and reusable evidence.
Proposed text for insertion or replacement
Startup and SME implementation pathway. Cyprus shall provide a proportionate, risk-based pathway comprising: free classification and regulatory clinics; AI literacy and standards navigation; model contract and DPIA/FRIA templates; compute and test-data vouchers; access to the statutory sandbox and testing facilities; security and red-team support; procurement-readiness coaching; staged grants tied to evidence and milestones; and support for CE-marking or conformity routes where legally applicable. Requirements shall scale by role, system risk and maturity. Public procurement shall use proportionate turnover, insurance and prior-experience criteria, suitable lotting and transparent challenge-based procedures, without unlawful nationality or residence discrimination. Funding shall address State-aid rules, intellectual property, follow-on finance, commercialisation and measurable additionality.
HLTF-24. Add liability, insurance, incident and forensic-evidence architecture
Strategy reference: §§3.3.2, 3.9, 3.13; Annexes B–C
Comment type: Liability / evidence / enforcement
Comment and implementation risk. The Strategy focuses on controls but not on who bears loss when AI fails. Software and AI are addressed by the revised EU Product Liability Directive, while contract, tort, professional duties, public-law liability and sector rules continue to apply. Dynamic models also require evidence that can reconstruct versions, inputs, outputs, human interventions and post-deployment changes. Ordinary logs may be incomplete or controlled by the supplier.
Requested amendment. Add a liability and evidence workstream before procurement, not after an incident.
Proposed text for insertion or replacement
Liability, insurance and forensic readiness. Every high-impact AI initiative shall maintain a responsibility and liability map covering provider, deployer, importer, distributor, integrator, data supplier, cloud/model provider, professional user and public authority. Procurement shall address the revised Product Liability Directive, applicable contract, tort, professional, public-law and sector liability; evidence disclosure; warranties; indemnities; caps; insurance; limitation periods; and recourse through the supply chain. Systems shall preserve proportionate, secure and admissible evidence of model/version, configuration, data provenance, inputs and outputs, human review, changes, incidents and remediation, with retention and access rules. Cyprus shall support CYS-coordinated participation in relevant AI, DLT and digital-evidence standardisation, including international forensic-evidence work, without predetermining its outcome.
HLTF-25. Make sustainability and island-resource constraints binding investment gates
Strategy reference: §§3.7.1–3.7.4, 3.13; Annexes C and F
Comment type: Sustainability / infrastructure / investment
Comment and implementation risk. Compute ambitions are not tied to an energy, water, land, grid, carbon or hardware-lifecycle baseline. For an island system, data-centre and AI-factory decisions can create material grid and water dependencies, stranded assets and exposure to imported equipment. Generic references to sustainable infrastructure are not enough for investment appraisal.
Requested amendment. Require resource and climate gates for all publicly funded compute and major cloud procurements.
Proposed text for insertion or replacement
Sustainable AI infrastructure. No major public AI compute or data-centre investment shall proceed without a published whole-life assessment of demand, utilisation, alternatives and shared European capacity; grid connection and resilience; energy source and additionality; water availability and WUE; PUE; embodied carbon and equipment lifecycle; heat reuse; land and permitting; supply-chain concentration; climate adaptation; decommissioning; and total public cost. Tenders shall include comparable metrics, metering, reporting, efficiency thresholds and improvement obligations. The National AI Infrastructure Council shall publish annual capacity, utilisation, energy, water, carbon, outage and cost indicators and explain whether local build, federated access or European shared capacity offers the best public value.
HLTF-26. Add labour, professional-responsibility, education and accessibility safeguards
Strategy reference: §§3.4–3.6; Education and Human Capital pillar; Annex C
Comment type: Employment / education / inclusion
Comment and implementation risk. The Strategy promotes augmentation and reskilling but does not provide workforce-impact assessment, worker consultation, protections for algorithmic management, professional accountability, academic integrity or equitable access. AI literacy is a legal obligation in the AI Act but cannot be reduced to tool training. Children, persons with disabilities, non-digital users and workers affected by monitoring or task redesign require specific safeguards.
Requested amendment. Insert a social and professional transition framework with accessibility by design.
Proposed text for insertion or replacement
Human capability and just transition. Public bodies and publicly funded projects shall assess workforce, professional-responsibility, equality, accessibility and skills impacts before deployment. Employers shall provide role-based AI literacy, consult workers and representatives where required, and retain accountable human professional judgement in regulated services. Education uses shall address child rights, teacher control, academic integrity, assessment validity and age-appropriate data protection. Digital services shall meet applicable accessibility requirements and maintain reasonable non-digital alternatives for essential services. The National AI Skills Observatory shall publish disaggregated outcomes, job-quality effects and skills gaps, while training credentials shall be quality-assured and clearly distinguished from standards, licences and regulatory certifications.

HLTF-27. Create sector legal maps before sector deployment
Strategy reference: Priority-sector roadmaps and Annex C
Comment type: Sector regulation / implementation
Comment and implementation risk. The Strategy’s sector roadmaps often state ‘full alignment’ with EU law without identifying the actual regulatory perimeter, competent regulator, professional decision-maker, evidence standard or additional sector approval. The result is greatest in health, finance, education, employment, maritime, critical infrastructure, justice, law enforcement and public benefits, where AI Act duties coexist with product, safety, data, consumer and professional rules.
Requested amendment. Make a sector legal and standards map a condition to funding and procurement.
Proposed text for insertion or replacement
Sector implementation dossiers. Before funding or procurement in a priority sector, the responsible ministry and competent regulators shall publish a dossier identifying: intended use and AI Act classification; provider/deployer and product-supply-chain roles; applicable sector and professional law; competent authorities; data-access and confidentiality rules; required authorisations and conformity route; fundamental-rights and safety assessment; standards profile; clinical, financial, educational, judicial or operational evidence; human decision authority; incident and complaint routes; liability and insurance; and post-deployment monitoring. At minimum, the dossiers shall address health and medical-device law and EHDS; DORA, MiCA, the DLT Pilot Regime and AML law for finance; education, employment and platform-work law; maritime and product-safety rules; and justice, law-enforcement and biometric safeguards.
HLTF-28. Replace aspirational KPIs with baselines, owners, budgets and independent evaluation
Strategy reference: §§1.5, 2.4, 4.4; Annex F; sector targets
Comment type: Delivery / public finance / evaluation
Comment and implementation risk. Headline targets – including GDP uplift, productivity, 75% adoption and three unicorns – are not accompanied by definitions, baselines, causal models, costs, sensitivity analysis or accountable owners. Adoption is not consistently dated (2030 and 2032). Annex F is described as indicative and may be changed without revising the core Strategy, weakening accountability. Counting deployments can reward low-value or risky use.
Requested amendment. Publish a costed delivery portfolio and independent evaluation protocol before commitments are treated as targets.

Proposed text for insertion or replacement
Delivery, finance and evaluation. Within 120 days, each programme shall have an accountable senior owner, delivery partner, legal basis, baseline, target definition, population, data source, methodology, milestones, dependencies, budget and funding source, procurement route, risk appetite, benefits-realisation plan and stop/scale criteria. Targets shall distinguish adoption from effective, lawful and sustained use. The 75% target and its year shall be reconciled across the document. Macroeconomic and productivity claims shall disclose the model, assumptions, confidence range and attribution limits. An independent evaluator shall publish annual results, incidents, distributional impacts, cost variance and reasons for continuation, modification or termination. Material KPI changes shall require a dated public change notice and governance approval.